GitHub Actions Caching: What We Measure First

Before touching cache keys, we ask teams to export workflow run timings for two weeks. The histogram usually shows one or two steps dominating wall clock. Fixing those first beats micro-optimizing lint. Cache poisoning concerns are real. We document which dependencies may be cached publicly versus which require scoped tokens. Students implement OIDC pulls instead of long-lived secrets, then re-run the timing export to confirm no regression. We also compare artifact sizes against download minutes. Sometimes skipping cache entirely and fetching a smaller tarball from object storage wins. The CI/CD course ends with each learner writing a one-paragraph decision record explaining their cache strategy. Finally, we remind teams to delete caches when rotating compromised tokens. It is a boring step that prevents spooky rebuilds later.